How to Install and Use apg in Linux to Generate Pronounceable Passwords

Generating cryptographically secure, high-entropy passwords directly from the command line is a daily requirement for Linux systems administrators, DevOps engineers, and security professionals. While utilities like pwgen or openssl generate arbitrary random strings, the Automated Password Generator (apg) specialises in generating pronouncable passwords paired with phonetic spelling breakdowns, alongside strict algorithmic complexity constraints based on US Federal Information Processing Standards (FIPS 181).

Why Use apg for Password Generation?

The apg tool offers distinct advantages over standard pseudo-random number generators:

• Pronounceable Passwords (FIPS 181): Standard random strings are difficult for human users to memorise or relay securely over voice communications without errors. apg generates phonetically balanced syllables based on strict phonetic transition algorithms.
• Phonetic Spellings: Every generated password is optionally output with its phonetic breakdown (e.g., NATO phonetic alphabet or hyphenated syllables), eliminating ambiguity between lookalike glyphs (such as O and 0, or l and 1).
• Strict Mode Complexity: You can enforce precise minimum character counts for lowercase letters, uppercase characters, digits, and special symbols to satisfy corporate Active Directory or PAM password policies.
• High-Entropy Cryptographic Mode: When human memorability is not required (such as generating database secrets, SSH keys, or API tokens), apg can switch into purely random cryptographic character generation.

Step 1: Install apg in Linux

The apg package is readily available in the official repositories of major Linux distributions:

1. On Ubuntu, Debian, or Linux Mint:

   sudo apt update && sudo apt install apg

2. On Fedora, CentOS Stream, or RHEL (via EPEL):

   sudo dnf install apg

3. On Arch Linux:

   sudo pacman -S apg

4. Verify installation:

   apg -v

Step 2: Generate Pronounceable Passwords with Phonetic Breakdowns

Running apg with default settings automatically produces pronounceable passwords accompanied by their pronunciation guides:

apg

The output prints several generated options alongside their phonetic representation:

drabDraf (drab-Draf)
cahbFic8 (cahb-Fic-EIGHT)
NeevUn6 (Neev-Un-SIX)
GrawvEd9 (Grawv-Ed-NINE)
GoyfRar5 (Goyf-Rar-FIVE)
pafJaf5 (paf-Jaf-FIVE)

To generate passwords using official NATO phonetic spelling for clear audio communication, invoke the -t flag:

apg -t

Step 3: Enforce Password Length and Character Complexity

Customise character boundaries and policy requirements using explicit command-line flags:

• Define Minimum and Maximum Length: Use -m (minimum length) and -x (maximum length). For example, to generate 14-character passwords:

  apg -m 14 -x 14

• Control Number of Passwords: Use -n to specify how many candidates to output:

  apg -m 16 -x 16 -n 4

• Enforce Character Sets with -M: Restrict or require specific character classes:
  • S = Special symbols
  • N = Numerical digits
  • C = Capital/uppercase letters
  • L = Lowercase letters
  To demand passwords containing uppercase, lowercase, numbers, and symbols:

  apg -M SNCL -m 16 -x 16

Step 4: Generate Truly Random High-Entropy Tokens

When generating secrets for machine consumption, server credentials, or service accounts where human pronunciation is irrelevant, enable random algorithmic mode via -a 1:

apg -a 1 -M SNCL -m 24 -x 24 -n 3

This disables pronounceable syllable rules and produces cryptographically dense, high-entropy character strings ideal for production infrastructure deployment.